feat(exec): 本地执行 Provider + 放权终端沙箱（白名单/工作目录/超时/输出截断/默认关）+ 文件沙箱；config 增 ExecSandbox(默认关)

internal/config/config.go

@@ -15,21 +15,22 @@ import (
 
 // Config is the root configuration tree.
 type Config struct {
-	Env             string   `env:"ENV" default:"development"`
-	LogLevel        string   `env:"LOG_LEVEL" default:"debug"`
-	Timezone        string   `env:"TZ" default:"Asia/Shanghai"`
-	DataDir         string   `env:"DATA_DIR" default:"./data"`
-	AllowedOrigins  []string `env:"ALLOWED_ORIGINS" default:"http://localhost:5173,http://localhost:3000"`
+	Env            string   `env:"ENV" default:"development"`
+	LogLevel       string   `env:"LOG_LEVEL" default:"debug"`
+	Timezone       string   `env:"TZ" default:"Asia/Shanghai"`
+	DataDir        string   `env:"DATA_DIR" default:"./data"`
+	AllowedOrigins []string `env:"ALLOWED_ORIGINS" default:"http://localhost:5173,http://localhost:3000"`
 
-	Server    ServerConfig
-	Auth      AuthConfig
-	DB        DBConfig
-	LLM       LLMConfig
-	Embedding EmbeddingConfig
-	IoT       IoTConfig
-	Voice     VoiceConfig
-	Background BackgroundConfig
-	WSHub     WSHubConfig
+	Server      ServerConfig
+	Auth        AuthConfig
+	DB          DBConfig
+	LLM         LLMConfig
+	Embedding   EmbeddingConfig
+	IoT         IoTConfig
+	Voice       VoiceConfig
+	Background  BackgroundConfig
+	WSHub       WSHubConfig
+	ExecSandbox ExecSandbox
 }
 
 // ServerConfig holds the single gateway listener settings.
@@ -76,16 +77,16 @@ type IoTConfig struct {
 
 // VoiceConfig holds TTS/STT provider settings.
 type VoiceConfig struct {
-	TTSProvider      string `env:"TTS_PROVIDER" default:"edge-tts"`
-	STTProvider      string `env:"STT_PROVIDER" default:"dashscope"`
-	DashscopeAPIKey  string `env:"DASHSCOPE_API_KEY"`
+	TTSProvider     string `env:"TTS_PROVIDER" default:"edge-tts"`
+	STTProvider     string `env:"STT_PROVIDER" default:"dashscope"`
+	DashscopeAPIKey string `env:"DASHSCOPE_API_KEY"`
 }
 
 // BackgroundConfig holds the autonomous thinking settings.
 type BackgroundConfig struct {
-	Enabled         bool `env:"ENABLE_BACKGROUND_THINKING" default:"true"`
-	IntervalSec     int  `env:"THINK_INTERVAL_SEC" default:"300"`
-	SilenceTimeout  int  `env:"THINK_SILENCE_TIMEOUT_SEC" default:"120"`
+	Enabled        bool `env:"ENABLE_BACKGROUND_THINKING" default:"true"`
+	IntervalSec    int  `env:"THINK_INTERVAL_SEC" default:"300"`
+	SilenceTimeout int  `env:"THINK_SILENCE_TIMEOUT_SEC" default:"120"`
 }
 
 // WSHubConfig holds the WebSocket hub limits.